Question

A newly appointed CRO discovers that risk-related decisions at a manufacturing company are frequently delayed and sometimes reversed. Investigation reveals that both the IT steering committee and the operational risk committee believe they hold final authority over technology risk acceptance, while business unit heads independently accept residual risks without informing either committee. Which action should the CRO prioritize FIRST to address the root cause?

Accepted Answer

Define and formally document risk governance roles, responsibilities, and decision-making authority across the committees and business units

Answer

Merge the IT steering committee and operational risk committee into a single body to eliminate duplication

Answer

Require all residual risk acceptances to be escalated directly to the board for approval

Answer

Implement a GRC tool to log and track all risk acceptance decisions in one place